Chapter 8: Testing the Operation of Controls

Text reading

One important point to note right at the beginning of this part of the Module is that the Table in your text showing the ASAs applicable to this chapter is lacking one very important one. In my view, there is MUCH in ASA330 that is very helpful to reassure you that what you are about to read is covered in the standards. As you will see below, there are many others that are being reinforced, but at the core of this possible response to risk assessment lies ASA330. I commend paragraphs 6–17 (and the relevant “A” explanatory paragraphs) for your attention. Whether you do this at the beginning, or end, or throughout I leave to you.

There is a very good summary of where you have come from and what you should understand as you begin studying this chapter right at the very beginning. Take your time and read through The Audit Process in Focus to satisfy yourself you appreciate where you are up to in the overall process to this point (Figure 4.5 in your text may be help as well). Reading your way through Ch 8 shows you the way to evaluate the operating effectiveness of the design (Ch 6) of internal controls for the type of business and industry your client operates within. You will find internal control is defined again but the focus is narrowed to just one of the five elements (or components) that you learned about in Ch 6. Here is a quick review activity for what was covered in Ch 6 and reinforced by reading Section 8.1.

As you work through the remainder of Section 8.1 it is important to appreciate that the nature of controls is constant whether they are manual or automated – how the controls operated, and are tested, will change; but the reason the controls are in place remains unchanged. Notice also that as you learn to distinguish between prevent and detect controls they are linked back to the management assertions you learned about in Chapter 5 (Module 2) for evidence … this will be an enduring feature of Module 3! Here are two activities to make sure you have read carefully.

As you move on through the chapter you will again be reminded that you are now learning how to apply knowledge you have been accumulating from earlier Modules. This is because you are continuing to use audit procedures to gather and accumulate sufficient appropriate audit evidence on which you will base your conclusions to support your audit opinion. In Module 2 (Ch 5) you were pointed to ASA500 and the range of audit procedures used to obtain audit evidence. You have learned already which of these are applied for the risk assessment process and now you are learning about those applied when you decide that CR is assessed at less than high for testing the operation of relevant internal controls. Notice the overlap … that is, some procedures are used for risk assessment AND tests of controls. The following activity will allow you to review which of the procedures from ASA500 are applicable at this point.

You will find a LOT of use of the phrase “large degree of professional judgement to be applied” throughout the remainder of Chapter 8. This includes judgements (decisions) about which controls you need to select for testing and the timing and extent of that testing (how many and how often). Then, of course, there is more judgement in deciding what the results of the testing means and the subsequent impact on your audit strategy … so notice again how you have the opportunity to review what have been learning – sampling and audit strategy. This is indicative of the audit process being “iterative”. This means a series of loops and circuits in the process that overlap and allow for adapting the strategy and plan. Table 8.3 offers a very good snapshot to help bring it all together when you reflecting on the need to test the operation of controls on which you intend to rely for the entire period … notice also, how that Table gives you pause to reflect on the accounting processes such that not ALL controls need to operate ALL the time. This goes to pre-requisite knowledge about accounting and accounting systems … again, nothing new (or it should not be!).

You may find it timely to review the discussion around professional judgement in ASA200 (I am confident you will be able to locate the relevant paragraphs by this stage). While I expect you will have had an initial read of this way back in Module 1, I am quite sure it will MEAN a whole lot more to you by now. Of course, remember there is a link to the Module 3 DF below if you want to initiate any dialogue about this.

The implication of this is that more senior members of the engagement team will make the decisions about the controls to test and the timing and extent of the testing (they have the experience) and less senior members of the engagement team carry out the procedures as per the audit program and document in the working papers the evidence obtained … then it is back to the more senior members for their review and support of conclusions and judgements about any need to adjust the audit strategy … so here you are “seeing” ASA220 in action yet again.

Section 8.3 will allow you to apply some of the principles you learned in Ch 7 about sampling. At this point, how they are applied to tests of controls. The key things to pick up are that when you test controls you are testing “attributes” (controls) and you are interested in whether they are operating effectively – as your text says succinctly on p.299 (2^nd Ed; 3^rd Ed Section 8.3.2) “the attribute being tested (for example, a signature, price or recorded balance) is correct or incorrect, present or absent, valid or not valid”. Even more basically, does the designed control work or not? If it does NOT this is called an exception (or deviation or deficiency). It is crucial because you are only testing a sample, to ensure that you are diligent and document ANYTHING that does not seem as it should be in your workpapers. Not only might this impact on your audit strategy, but it may also need to be communicated to the appropriate level of management (those charged with governance) – and here you go back to ASA260/265 and relevant case law.

Also as you are reading about the wide range of factors that might influence the extent of testing, ponder what you are often reminded of … no need to commit things to memory … get in the habit of finding where they might be in the relevant ASA. By now you should be well aware of the use of Appendices throughout the ASAs. If we are talking about sampling here, I wonder what ASA provides the guidance and if it has any Appendices that might help? Hopefully by now, this is the way you are beginning to think about “using” your standards. And certainly by now you really need to be recognising these threads back through your knowledge.

The reason for documenting the results of your tests of internal controls is to assess the impact on your remaining (substantive) testing to minimise the risk of material misstatements finding their way into the financial reports. This also supports any basis to identify weaknesses in internal controls as noted above.

Questions and Activities (Text Chapter 8)

Remember, if you wish to review your comprehension of the content you should feel free to attempt the:

• Multiple Choice Questions, and
• Review Questions presented for each Chapter.

You will find suggested answers to Multiple Choice Questions at the very end of each Chapter. You will NOT find suggested answers to the Review Questions provided BECAUSE I expect that you are capable of locating the relevant material in the Chapter … the questions are in the same sequence as the objectives and sections of the Chapter.

You should NOT expect Multiple Choice or Review style questions in your Final Examination – the style of questions will be based on those set out below that are designed to develop your skills at applying the content you have been learning.

You are provided with suggested feedback for each of these questions. Remember it is very important that you attempt to develop an answer for yourself BEFORE you check the suggestion – otherwise you will NOT learn to apply your knowledge. A direct link is provided for the suggested answers. A new window will open for your use; alternatively, there is a word version of all feedback for each Module.

Text Chapter 8: PAQ 8.29

Text Chapter 8: PAQ 8.34

Text Chapter 8: PAQ 8.31

Text Chapter 8: PAQ 8.32

Module 3 Discussion Forum

If there are any suggested answers, or even material you have been reading, that do not make sense or require clarification please use the Module 3 Discussion Forum (DF) to ask for help!

Remember to try and be as specific as possible about what is not clear to you so that replies can be most immediately helpful; and you are encouraged to help each other and not rely solely on staff responding.

The Lakeside Company case

This short lesson is designed to show you how assessing the design of internal controls drills down into specific parts of the accounting cycle – distributorship sales on credit and resulting accounts receivable. Reading the narrative for the case will show you how you continue to corroborate by further enquiries and discussions; in other words you will see references to Case 1 (background information for your potential new client) and Case 4 (overall systems and control environment). You will also see another type of internal control questionnaire to reinforce, again, that there are very few “standard” formats for audit working papers. So once again, the terms: sufficient, appropriate, evidence, documentation, working papers will mean a lot more as your study of Module 3 and exploration of exhibits in Lakeside cases continues.

Case 5: Tests of Controls: the revenue ∓ cash receipts cycle (4 pages)

The key here is to realise you are “interviewing”, making an enquiry, having a discussion with a key employee (not manager) responsible for the operation and oversight of this part of the accounting cycle. Think back to the internal control elements you learned in Ch 6 and what features YOU would like to hear in the responses to the questions … remember the suggestion in the Ch 8 part of this Module to review “professional judgment”. This is an example.

Read the Case carefully; take some time to think about what you have read; see how you go with the following activities.

Questions and Activities (Lakeside)

It is recommended that you follow the sequence of questions presented. You are being encouraged to explore how the various resources (readings, case, text and standards) you are being asked to use are interrelated and not a series of discrete items to be learned individually.

Lakeside Case 5: Ex 1

Lakeside Case 5: DQ 5

Lakeside Case 5: DQ 1

Lakeside Case 5: DQ 4

Module 3 Discussion Forum

You should be improving your knowledge of how A&C operates as well as what information is needed for them to make more of their risk assessment judgements. Before moving on, it is recommended you make some time to pause and reflect on your progress … If there are any suggested answers, or even material you have been reading, that do not make sense or require clarification please use the Module 3 Discussion Forum (DF) to ask for help!

You are encouraged to help each other and not rely solely on staff responding.

Chapter 9: Performing substantive procedures

Text reading

One important point to note right at the beginning of this part of the Module is that the Table showing the ASAs applicable to this chapter is beginning to point you to the range of ASAs in the “500” section of the standards; that is, those supporting ASA500 on audit evidence most directly. As you cover Chs 10 & 11 you will see you are referred to even more to be aware of … remember you do not need to “know” the content, just what they cover so you can refer to them if you need to … develop an awareness of your resources.

Section 9.1 should be another useful review of what you already “know” – a reminder of where you are up to in The Audit Process (again, Figure 4.5 in your text may be worth looking at to notice while you are at the bottom much remains to be done!). Reading your way through Ch 9 shows you again how those assertions are central to what we need to be designing our audit procedures against. Pay special attention to Table 9.1 and some the subtle differences between the uses of similar terminology. Here is a quick review activity for what was covered by reading Section 9.1.1.

As you work through the rest of Section 9.1 you will be reminded again of the range of potential audit procedures (ASA500) you can apply to gather sufficient and appropriate audit evidence – this time for substantive testing, focusing on the amounts that appear in the financial reports rather than the processes generating those amounts (control activities). Notice again the overlap … that is, some procedures are used for risk assessment AND tests of controls AND substantive procedures. Here are two activities to make sure you have read carefully.

As you move on through the remainder of the chapter you explore the meaning of “nature, timing and extent” as they apply to substantive procedures. Once again, I point out that if you need an overview of this to corroborate what your text is talking about, make the effort to review the relevant paragraphs in ASA330 – remember this is a key part of your Risk Response (to your earlier risk assessments). I am deliberately NOT specifying paragraphs because you should be more than able to locate these on your own by now. One important feature of substantive procedures to be clear about is the distinction between vouching and tracing. This is very important when choosing the correct population from which to sample and is dependent on the assertion you are gathering evidence about. Vouching typically tests the existence and occurrence assertions for overstatement. Tracing typically tests the completeness assertion for understatement. The following activities will allow you a sense that you are on the right track with your understanding. Of course, the Questions and Activities below are even better guidance!

The final parts of the chapter deal with the range of analytical procedures when they are used as substantive procedures (remember, this is covered in detail in ASA 520) and how and what you document to support your conclusions for the substantive procedures carried out. Notice, that for substantive procedures we talk about documenting and evaluating “errors” and “misstatements” because we are substantiating amounts ($) for transactions and balances. A final point to bear in mind here, based on your knowledge of double-entry accounting principles, is that an error or misstatement can be an understatement or an overstatement and it is the AGGREGATE of any errors or misstatements that we evaluate for materiality when we form our opinion. Think about which elements of the financial reports (revenue, expense, asset, liability, equity) we would “expect” to be understated and which overstated … or put another way, which of those elements would we NOT like to see over or under stated. Think back to your risk assessment process :).

Questions and Activities (Text Chapter 9)

Remember, if you wish to review your comprehension of the content you should feel free to attempt the:

• Multiple Choice Questions, and
• Review Questions presented for each Chapter.

You will find suggested answers to Multiple Choice Questions at the very end of each Chapter. You will NOT find suggested answers to the Review Questions provided BECAUSE I expect that you are capable of locating the relevant material in the Chapter … the questions are in the same sequence as the objectives and sections of the Chapter.

You should NOT expect Multiple Choice or Review style questions in your Final Examination – the style of questions will be based on those set out below that are designed to develop your skills at applying the content you have been learning.

You are provided with suggested feedback for each of these questions. Remember it is very important that you attempt to develop an answer for yourself BEFORE you check the suggestion – otherwise you will NOT learn to apply your knowledge. A direct link is provided for the suggested answers. A new window will open for your use; alternatively, there is a word version of all feedback for each Module.

Text Chapter 9: PAQ 9.34

Text Chapter 9: PAQ 9.35

Text Chapter 9: PAQ 9.36

Text Chapter 9: PAQ 9.37

Module 3 Discussion Forum

You should be improving your knowledge of how A&C operates as well as what information is needed for them to make more of their risk assessment judgements. Before moving on, it is recommended you make some time to pause and reflect on your progress … If there are any suggested answers, or even material you have been reading, that do not make sense or require clarification please use the Module 3 Discussion Forum (DF) to ask for help!

You are encouraged to help each other and not rely solely on staff responding.

Remember to try and be as specific as possible about what is not clear to you so that replies can be most immediately helpful; and You are encouraged to help each other and not rely solely on staff responding.

Chapters 10 & 11: Substantive testing balance sheet and income statement accounts

Text reading

One important point to note right at the beginning of this part of the Module is that the Table showing the ASAs applicable to these chapters points you to more ASAs in the “500” section of the standards; as well as a number of key AASBs. NOTE that you do not need to “know” or memorise these AASBs or even have a copy of the Accounting Standards Handbook for this unit … your awareness of how to access AASBs is presumed from pre-requisite units. What you should appreciate better by now is the way that auditing and accounting standards often complement one another. Specific knowledge of each is NOT the point … knowing how and which standards to access for specific problems is what professionals develop skills with. You are merely being introduced to this skill in this unit. So, as you cover Chs 10 & 11 you will see you are referred to even more standards to be aware of … remember you do not need to “know” the content, just what they cover so you can refer to them if you need to should any activities direct you to do so.

Chs 10 & 11 are dealt with simultaneously in this lesson because the testing (procedures) are merely being split up for the balance sheet and income statement. The application of the principles is consistent across the two chapters. It is also important that you take time at the outset to reflect on the double entry nature of accounting and the overlap between the two financial reports that results. The following Figure from Arens et al. (Figure 17.1, p. 630) is provided as a reminder. It is important to take time to digest this Figure … it shows how substantive procedures for transactions and balances overlap as you audit individual accounts within the various accounting cycles. Another way to think of this is that as you test one side of an accounting entry, you are indirectly gathering evidence about the other side of the accounting entry. Those sides may affect one financial report, or the other, or both.

An important point to realise from your reading is that your decision about the extent of substantive procedures is dictated by what your accumulated evidence has revealed so far throughout the audit process. You will read, again, how your risk assessment and results of (any) tests of controls impact on how much reliance you need to place on your substantive procedures. Figure 10.2 provides an excellent summary of this. Note, by now you should be able to make your own annotation for where higher and lower DR (detection risk) and AR (audit risk) would appear on the horizontal axis of the Figure.

The other important point to note is about the determination of what are significant risks (accounts and disclosures). You will recall that this term is an important one from ASA 315 & 330. This will also serve to reinforce the importance of senior members of the engagement team with the most experience being the ones involved in making these decisions (ASA220.18–22 … notice we are still being very conscious of quality assurance/control covered way back in Module 1 … learning now what it “actually looks like”). So, the “mechanics” involved are NOT what I expect you to learn. It is the relationships among the risk factors and evidence and procedures, as well as the alternative strategies that you need to be able to show an appreciation of. This includes the way assertions are now being tested in detail.

Here is an example for Cash.

Testing cash account balances is always done at some level, though additional procedures for transactions may be required as the risk of material misstatement assessment (IR and CR) increases. When CR is assessed as lower you are unlikely to do additional testing on cash receipts and payments (transaction) and focus on testing the cash balance. If CR is assessed as other than low, substantive tests of receipts and payments may be required in addition to testing the cash balance. Note that in deciding to assess CR as low, you will have accumulated evidence obtained from interim testing on significant cash transactions – this will most likely have been from control testing and substantive testing of transactions (dual purpose testing) when you were testing the successful operation of controls.

Similar logic will be applied to other key components of the balance sheet and income statement throughout Chs 10 & 11. Notice, again, that you are applying principles you already “know” to selected (significant) accounts on each of the balance sheet and income statement. The detail encourages you to review your fundamental knowledge of how accounting cycles function for the processing of transactions to generate the financial reports. Thus, you are testing those assertions set out in ASA315 until you are satisfied you have sufficient appropriate audit evidence to have a reasonable basis on which to form the relevant audit opinion (Module 4).

Another point to realise is the way the definitions for each of the assertions that you learned in Module 2 (and can easily check in ASA315 or your Glossary) are tailored for each account that you explore throughout Chs 10 & 11. To illustrate this, here is an example for inventory from your text showing the assertion in the right hand column with the tailored definition in the left hand column (Table 10.7). The point here is that the various Tables sprinkled through the chapters are not a magical construction … just a simple adaptation (application) of the knowledge you already have to various accounts that appear in the financial reports.

Try the following activity to review some of what you have been reading.

You will also find there are Tables providing examples of substantive tests of transactions and balances for each main type of account on the balance sheet and income statement (two examples are Tables 10.5 and 10.6 for trade receivables). It is important to be aware that these classifications are “standard” – this means that for most audit clients, most of the time, they will hold true. However it is crucial to remember that each client needs to be (re)evaluated each year for any things that may have changed to be unique to the way that client operates and so require adaptation of what might be “normal”. This again is part of the reason you go through understanding your client and their industry during the risk assessment phase (Module 2).

Significantly, each of the examples in the relevant Tables are linked to the most applicable assertions. Pay particular attention to the way specific tests require you to vouch back to supporting documents from a ledger, or trace forward from source documents to a ledger.

Here is an example extracted from Table 10.5 using trade receivables. Further explanation of how these Tables should be reinforcing material and principles you have already learned follow in the activities below the extract.

In the Sales Process column, accounting for the numerical sequence is an example of a test of control being used to test the completeness and cut-off assertions by making sure all numbered documents for this cycle are fully accounted for (all there). If we were to draw a sample whether we used sales invoices, sales orders or shipping documents would depend on how the documents are filed in the client's records – this we would “know” from the flowcharts or narratives we have included in our permanent working paper file. The reason to reconcile the billings (invoices) is so we are satisfied that what was ordered has been shipped and billed (invoiced).

Try this activity for the first item in the Sales Returns and Allowances column:

In the Cash Receipts column, the population from which to draw a sample for tracing could be remittance advices, list of cash receipts, duplicate deposit slips. As indicated for Sales Process column it depends on the specifics of the client's system. That is why you document your understanding as the audit progresses. The transaction file is an example of an automated journal (in this case cash receipts journal) and a good example of how the terminology you come across for different clients’ needs to be adapted to the principles you know – even though it is important to communicate with the client in “their language”. Think about what and “abnormal delay” might be for the deposit of cash receipts … when would you expect cash receipts to banked? Normally every day! What would constitute an acceptable delay? The weekend; a public holiday (compare an Easter 4 day break with an Anzac Day 3 day break); perhaps the Christmas–New Year break is a period where the business closes for a couple of weeks. Notice again … all that knowledge of the client's business and their industry that your “know” from early in the process.

Differences between auditing income statement and balance sheet accounts is well explained at the beginning of Ch 11 and is well worth more than a passing thought. This is because it is tempting to think, “ah, just another account to check”. Never quite that simple in auditing!

In the final part for Module 3 you will have the opportunity to put some of what you have learned about documenting audit evidence and carrying out some audit procedures into practice with some substantial activities from Lakeside. These should be very helpful in closing your learning loop on the audit process to date.

Questions and Activities (Text Chapter 10–11)

Remember, if you wish to review your comprehension of the content you should feel free to attempt the:

• Multiple Choice Questions, and
• Review Questions presented for each Chapter.

You will find suggested answers to Multiple Choice Questions at the very end of each Chapter. You will NOT find suggested answers to the Review Questions provided BECAUSE I expect that you are capable of locating the relevant material in the Chapter … the questions are in the same sequence as the objectives and sections of the Chapter.

You should NOT expect Multiple Choice or Review style questions in your Final Examination – the style of questions will be based on those set out below that are designed to develop your skills at applying the content you have been learning.

You are provided with suggested feedback for each of these questions. Remember it is very important that you attempt to develop an answer for yourself BEFORE you check the suggestion – otherwise you will NOT learn to apply your knowledge. A direct link is provided for the suggested answers. A new window will open for your use; alternatively, there is a word version of all feedback for each Module.

Text Chapter 10 PAQ 10.36

Text Chapter 10 PAQ 10.34

Text Chapter 11 PAQ 11.32

Text Chapter 11 PAQ 11.35

Text Chapter 11 PAQ 11.36

Module 3 Discussion Forum

You should be improving your knowledge of how A&C operates as well as what information is needed for them to make more of their risk assessment judgements. Before moving on, it is recommended you make some time to pause and reflect on your progress … If there are any suggested answers, or even material you have been reading, that do not make sense or require clarification please use the Module 3 Discussion Forum (DF) to ask for help!

You are encouraged to help each other and not rely solely on staff responding.

Remember to try and be as specific as possible about what is not clear to you so that replies can be most immediately helpful; and You are encouraged to help each other and not rely solely on staff responding.

The Lakeside Company case

This short lesson will allow you to see a variety of examples and illustrations within Lakeside Cases of the types of substantive procedures that you have been studying in Chs 9–11 of your text. Once again, as was the case for tests of controls, these activities are designed to show you how substantive testing of details of transactions and balances drills down into specific parts of the accounting cycle (payroll, credit purchases and payments, property plant and equipment and finally, estimates of warranty expense) … a final reminder of the importance of the pre-requisite accounting knowledge you brought to the unit. So once again, the terms: sufficient, appropriate, evidence, documentation, working papers will mean a lot more as your wind up Module 3 by continuing your exploration of exhibits in Lakeside Cases.

For most of the discussion questions (DQ) below it is NOT necessary to have read the relevant case in detail. Most likely it will be helpful to do so, but referring to applicable Exhibits or parts of the narrative you are referred to in the question will normally be sufficient.

Questions and Activities (Lakeside)

It is recommended that you follow the sequence of questions presented. You are being encouraged to explore how the various resources (readings, case, text and standards) you are being asked to use are interrelated and not a series of discrete items to be learned individually.

Lakeside Case 7: DQ 3

Lakeside Case 7: DQ 4

Lakeside Case 5: DQ 10

Lakeside Case 12: DQ 10 AND 11 (together)

Lakeside Case 6: DQ 2

Lakeside Case 5: DQ 9

The following set of activities (exercises from Lakeside) will provide you with the opportunity to see what it is like to prepare some workpapers (documentation) showing the evidence gathered as you execute (carry out) some audit procedures specified in an audit program.

NOTE: doing these is likely to consume between 6–8 hours if you attempt them fully. I can only suggest that doing so will help draw many of the pieces of the process together; if you feel you cannot find the time then even partially completing the tasks will help!

It is also VERY IMPORTANT that you DO NOT feel overly concerned that your work paper style or layout does not look like the suggested answer … what is far MORE important is that you can “see” the substance of how you have documented your work in the suggested solution – the format is NOT as important as the substance. This is because in reality, each audit firm will train you in “their” style, or their way of doing the work papers.

 Lakeside Case 6: Ex 2

 Lakeside Case 9: Ex 1

 Lakeside Case 12: Ex 1

Module 3 Discussion Forum

You should be improving your knowledge of how A&C operates as well as what information is needed for them to make more of their risk assessment judgements. Before moving on, it is recommended you make some time to pause and reflect on your progress … If there are any suggested answers, or even material you have been reading, that do not make sense or require clarification please use the Module 3 Discussion Forum (DF) to ask for help!

You are encouraged to help each other and not rely solely on staff responding.